Skip to content
OpenAdvisories
Medium ALAS2-2021-1589 1 CVE

Moderate: python-rtslib security update (Amazon Linux 2)

Published Jan 25, 2021 · Updated Jan 26, 2021

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-14019: A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for /etc/target/saveconfig.json because the shutil.copyfile, instead of shutil.copy is used, and permissions are not preserved upon editing. This flaw allows an attacker with prior access to /etc/target/saveconfig.json to access a later version, resulting in a loss of integrity, depending on their permission settings. The highest threat from this vulnerability is to confidentiality. 1854723: CVE-2020-14019 python-rtslib: weak permissions for /etc/target/saveconfig.json

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 python-rtslib 0:2.1.74-1.amzn2
Amazon Linux · 2 python-rtslib-doc 0:2.1.74-1.amzn2

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-14019.html